search

decred / politeia

ISC License
110 stars 75 forks source link

Invalidate all sessions of a user on password change #1680

Open jholdstock opened 1 year ago

jholdstock commented 1 year ago

This was implemented previously in #647 but the functionality seems to have stopped working.

Sharing the report which came in from the bug bounty program:

While conducting my research I discovered that the application failed to invalidate the session after password change from profile settings. In this scenario changing the password doesn’t destroy the other sessions logged in with old passwords.

Steps to reproduce:

  • Register an account on https://proposals.decred.org

  • Login with the same account in Chrome and Firefox Simultaneously.

  • In Chrome Browser go to Profile https://proposals.decred.org/user/?tab=account and change the password.

  • Go to Firefox and Update any information, information will be updated *If the attacker login with Firefox and the user knows his password is stolen so even user changes their password, his account remains insecure and the attacker has full access to the victim's account.

If the attacker has a user password and logs in different places, As other sessions are not destroyed, the attacker will still be logged in to your account even after changing the password, cause his session is still active. A malicious actor can completely access your account till that session expires! So, your account remains insecure even after the change of the password.